bisecting fixing commit since 811218eceeaa7618652e1b8d11caeff67ab42072 building syzkaller on a52ee10ae11c1342cfca60cf3957619bcf92bd1a testing commit 811218eceeaa7618652e1b8d11caeff67ab42072 compiler: gcc version 8.4.1 20210217 (GCC) kernel signature: 03cd9b3b86e98a15f6f0d8b13d125091d1989271d5bdd3109a7a3cb072f6ddf3 run #0: crashed: KASAN: use-after-free Read in __queue_work run #1: crashed: WARNING: ODEBUG bug in bt_host_release run #2: crashed: WARNING: ODEBUG bug in bt_host_release run #3: OK run #4: OK run #5: OK run #6: OK run #7: OK run #8: OK run #9: OK run #10: OK run #11: OK run #12: OK run #13: OK run #14: OK run #15: OK run #16: OK run #17: OK run #18: OK run #19: OK reproducer seems to be flaky testing current HEAD 5c66974a63046780925e5d99b6dc6631fe2f9a31 testing commit 5c66974a63046780925e5d99b6dc6631fe2f9a31 compiler: gcc version 8.4.1 20210217 (GCC) kernel signature: d6ef3e69f25c283bdc04d6fe537db9a72be79dec2f0661e04281d6f038d2b49d all runs: crashed: BUG: sleeping function called from invalid context in lock_sock_nested Reproducer flagged being flaky revisions tested: 2, total time: 34m53.719312984s (build: 20m37.619203313s, test: 13m45.760552324s) the crash still happens on HEAD commit msg: Linux 4.19.202 crash: BUG: sleeping function called from invalid context in lock_sock_nested Bluetooth: hci0: command 0x0401 tx timeout Bluetooth: hci0: command 0x0401 tx timeout Bluetooth: hci0: command 0x0401 tx timeout Bluetooth: hci0: command 0x0401 tx timeout BUG: sleeping function called from invalid context at net/core/sock.c:2863 in_atomic(): 1, irqs_disabled(): 0, pid: 8467, name: syz-executor.4 1 lock held by syz-executor.4/8467: #0: 00000000b4c72555 (hci_sk_list.lock){++++}, at: hci_sock_dev_event+0x361/0x5e0 net/bluetooth/hci_sock.c:756 Preemption disabled at: [] hci_sock_dev_event+0x361/0x5e0 net/bluetooth/hci_sock.c:756 CPU: 1 PID: 8467 Comm: syz-executor.4 Not tainted 4.19.202-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x17c/0x226 lib/dump_stack.c:118 ___might_sleep.cold.15+0x1f1/0x265 kernel/sched/core.c:6192 __might_sleep+0x95/0x190 kernel/sched/core.c:6145 lock_sock_nested+0x24/0x100 net/core/sock.c:2863 lock_sock include/net/sock.h:1510 [inline] hci_sock_dev_event+0x3e4/0x5e0 net/bluetooth/hci_sock.c:758 hci_unregister_dev+0x20b/0x890 net/bluetooth/hci_core.c:3292 vhci_release+0x6b/0xe0 drivers/bluetooth/hci_vhci.c:354 __fput+0x249/0x7f0 fs/file_table.c:278 ____fput+0x9/0x10 fs/file_table.c:309 task_work_run+0x108/0x180 kernel/task_work.c:113 exit_task_work include/linux/task_work.h:22 [inline] do_exit+0xa6a/0x2d90 kernel/exit.c:870 do_group_exit+0xf8/0x2c0 kernel/exit.c:967 __do_sys_exit_group kernel/exit.c:978 [inline] __se_sys_exit_group kernel/exit.c:976 [inline] __x64_sys_exit_group+0x39/0x40 kernel/exit.c:976 do_syscall_64+0xd0/0x4e0 arch/x86/entry/common.c:293 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x465b09 Code: 00 e9 30 ff ff ff 83 f9 77 75 26 48 83 b8 d8 00 00 00 00 7c e2 83 f9 72 75 10 80 78 19 00 74 0a b9 03 00 00 00 e9 0c ff ff ff <31> c9 e9 05 ff ff ff 83 f9 72 eb e2 e8 c6 35 00 00 e9 c1 fe ff ff RSP: 002b:00007ffdb5ca5598 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 RAX: ffffffffffffffda RBX: 00000000000000e9 RCX: 0000000000465b09 RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000043 RBP: 00000000004b0265 R08: 000000000000000b R09: 0000000000000006 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000020740 R14: 0000000000000006 R15: 00007ffdb5ca5780 BUG: scheduling while atomic: syz-executor.4/8467/0x00000002 1 lock held by syz-executor.4/8467: #0: 00000000b4c72555 (hci_sk_list.lock){++++}, at: hci_sock_dev_event+0x361/0x5e0 net/bluetooth/hci_sock.c:756 Modules linked in: Preemption disabled at: [] hci_sock_dev_event+0x361/0x5e0 net/bluetooth/hci_sock.c:756